Data breaches like the one reported by Halifax Water happen often: expert

Cybersecurity experts say hacks like what Halifax Water is facing are becoming all too common and defence against them isn't keeping up.

Nova Scotians, specifically Haligonians, are all too familiar with the feeling of knowing there’s been a breach and customer data has been exposed.

On Friday, Halifax Water reported that it was investigating “unauthorized access to information” from the utility’s online Customer Connect portal.

In March of last year, Nova Scotia Power reported a cyberattack that compromised the personal data of 280,000 customers.

Just last week, the Canadian Centre for Cyber Security warned in a memo that Iranian reprisals will “very likely” include cyberattacks.

Cybersecurity and privacy lawyer Brent Arnold, based in Toronto, says he thinks the Halifax Water hack is a ransomware attack.

“The playbook is, you notify the people that need to be notified, you share as much as needs to be shared, but you avoid speculation, and you don’t get into more detail,” Arnold says.

“These kinds of attacks are happening all the time. Critical infrastructure, like water, like power, is always a ripe target because they know that they have customer information and they essentially know they can hold them hostage if they get enough of it.”

Halifax Water says there is no indication that financial information is at risk. The utility did not say when the breach occurred.

“The thing about cybersecurity is this is basically an arms race,” Arnold says.

“The attacks are always getting more sophisticated. The defence continues. You hope to get more sophisticated, but we’re always trying to catch up with the attackers, and they’re always getting smarter.”

He says Halifax Water likely won’t share details about what the hacker(s) did to prevent someone else from trying the same technique.

“There’s between two and 500 new vulnerabilities discovered every single week,” says Terry Cutler, CEO of Cyology Labs, a cybersecurity firm in Montreal. “Most of the time, these organizations are only doing an audit once a year.”

Halifax Water says, “protecting customer information and maintaining reliable service are top priorities.”

Cutler argues the utility has fallen short. “If you cared so much, then why didn’t you protect it?”

He says the average time a hacker spends inside a network is 286 days.

“They need to get much more proactive on the audits and stay up to date with the latest threats,” Cutler says.

It’s a challenge because updates to fix vulnerabilities sometimes open other holes, he says.

Halifax Water did not say how long its portal will be shut down. They said more information will be provided on Monday and “appropriate authorities” have been notified in a statement. It says it is strengthening its system protections and reviewing security practices.

The utility is urging anyone who receives a call from someone claiming to be Halifax Water to hang up and call the number on its website.

For more Nova Scotia news, visit our dedicated provincial page